Three identities per zone keep a delete-and-recreate from becoming an identity failure

A deleted zone is the easy failure. According to the post, a write that reaches no zone is easier to notice, while a write that reaches the wrong zone can be syntactically successful and still violate intent ^[15]. An account move, a delete-and-recreate event, or stale inventory is enough to produce that state when the provider ID is the application's primary key ^[4].

Harder to catch is a green deployment paired with the wrong published MX set ^[9]. The application accepted the change, the worker completed, and the remote write returned normally; the post says none of those observations establishes that intent and publication match ^[9].

Of the three identities in the model, the application issues one ^[1]. The application key stays stable through infrastructure changes, the domain is the assertion checked at the provider boundary, and the provider ID is cached coordination data that can be replaced after discovery or reconciliation ^[3]. A name-based lookup on every mutation removes the cached ID, and the post's objection is that it adds another resolution step whose result can drift too ^[6]. Storing only the provider ID is worse, because the application loses an independent way to detect misbinding ^[7].

Desired state is the exact MX owner, preference and exchange values approved for company mail ^[18]. Counted out, one approved change costs four reads and at most one write: the current zone binding, the remote zone resolution, the published record set before, and the published set after ^[2]. Only that last comparison closes the operation ^[8].

The post's author wrote, "I bring an idempotency reflex to this problem because I've been paged by missed scheduled jobs and duplicate queue deliveries," and said that "a job executing once is not a reliability property" ^{[16] [17]}.

The retry rule is the part that matters during overlap. If current state already equals desired state, the worker skips the write and goes to observation; if it differs, it submits the replacement once for that desired-state revision ^[12]. A difference at the observation step leaves the revision pending and schedules another observation, and it does not cause another mutation unless the control-plane read also shows drift ^[13].

Before any write, the worker resolves the zone inside the expected account and checks the returned domain against dispatch.example; a mismatch stops the mutation and creates an identity alert ^[11].

The post does not disclose a DNS provider, an API, or a measured incident, and the independent observation path is up to the team ^{[20] [21]}. Four reads and a revision counter for one MX set is more machinery than the change appears to need. In my view it pays where mail carries dispatch traffic and DNS control moves between accounts; on a single-account zone nobody migrates, the cached ID and one write are fine.